PwC TLS | Information Notice | Survey compilation

Information notice given pursuant to article 13 of the GDPR in relation to surveys

TLS Associazione Professionale di Avvocati e Commercialisti (hereinafter “TLS”), having its seat in Milan, Piazza Tre Torri, n. 2, in the person of its pro-tempore legal representative, being the Controller of the data you have communicated for the purpose of the survey described below, together with

SERVIZI AZIENDALI PRICEWATERHOUSECOOPERS S.r.l. (hereinafter “SAPwC”), with registered office in Milan, Piazza Tre Torri, n. 2, in the person of its pro-tempore legal representative, a company that provides several administrative, accounting and organisational services to all Italian entities of the PwC Network PwC¹ to which PwC and SAPwC belong, (hereinafter, “Joint Controllers”)

whereas The aforementioned entities have entered into a Joint Controller agreement pursuant to article 26 of the, GDPR², the essential content of which is available on demand on the Joint Controllers’ premises, provide the following information pursuant to article 13 of the GDPR (in brief, “Information notice”).

(a) Identity and contact details of the Joint Controllers

  TLS Associazione Professionale di Avvocati e Commercialisti
  Piazza Tre Torri, n. 2 - 20145 Milan
  Tax code / VAT no.: 12142310155
                Tel. (02) 77851

                SERVIZI AZIENDALI PRICEWATERHOUSECOOPERS S.r.l.
  Piazza Tre Torri, n. 2 - 20145 Milan
C.F. e P.IVA: 12449670152
                Tel. (02) 77851

(b) Contact details of the Data Protection Officer

Office of the Data Protection Officer (“DPO”)
Piazza Tre Torri, n. 2 - 20145 Milan
Certified email address PEC dpo-tls@pec-pwc.it
Tel. (02) 91606560
Fax (02) 91606561

(c) Purposes of the processing of personal data and legal basis

Your personal data shall be processed:
(i) Without your consent (GDPR article 6, letters b, c, f), for the following purposes:

complying with pre-contractual and contractual obligations arising from a proposed professional engagement,
complying with national or EU laws and regulations, or executing an order from a judicial authority or a supervisory entity with oversight over the Joint Controllers,
exercising the rights of the Joint Controllers, specifically legal defence;

(ii) With your consent (article 7 of the GDPR) for the purpose of compiling the survey promoted by PwC and designed to ascertain the degree of satisfaction of clients for the professional services rendered by PwC (hereinafter, the “Survey”).

Your consent to provide your data for the purposes set out above is optional. If you expressly refuse, you will not be able to take part in the Survey.

(d) Categories of personal data collected and processed

For the purposes listed under (c) above, the personal data that will be collected and processed are, for instance, your name, family name and e-mail address.

(e) Categories of addresses of the personal data

For the purposes listed under (c) above, the personal data that you provide may be made accessible to employees and collaborators of the Joint Controllers, in their capacity as persons authorised to process the data (the “persons tasked with processing”).

Your personal data may also be accessed by Qualtrics, LLC, 333 W River Park Dr, Provo, UT 84604 USA, being the provider of the IT platform necessary to manage the Survey.

(f) Storage and transfer of personal data abroad

The personal data are managed and stored in the cloud and on servers located within and without the European Union that are owned or leased by the Controller and/or third parties engaged and duly appointed as Processors.

The transfer of personal data to countries outside the EU takes place in compliance with the provision of Chapter V of the GDPR (article 46), through the adoption of standard clauses drawn up on the basis of the wording in Decisions of the European Commission No. 2004/915/EC and 2010/87/EU.

Your personal data shall not be disseminated.

(g) Period for which the personal data will be stored

The personal data shall be stored for the entire duration of the professional relationship; from the date the relationship ends, for whatever reason, the data shall be stored consistently with the storage periods adopted in relation to the performance of professional engagements.

(h) Rights of the data subject

In accordance with Chapter III, Section I of the GDPR, you can exercise the rights listed therein, specifically:

Right of access – The right to obtain confirmation as to whether or not personal data concerning yourself are being processed and, if this is the case, to receive, among other things, the following information: the purposes of the processing, the categories of personal data concerned and the period of storage, the recipients to whom the personal data may be disclosed (article 15 of the GDPR),
Right to rectification – The right to obtain, without undue delay, the rectification of inaccurate personal data concerning yourself and to have incomplete personal data completed (article 16 of the GDPR),
Right to erasure – The right to obtain, without undue delay, the erasure of personal data concerning yourself, in the circumstances contemplated in the GDPR (article 17 of the GDPR),
Right to restriction of processing – The right to obtain from the Joint Controllers restriction of processing, in the circumstances contemplated in the GDPR (article 18 of the GDPR),
Right to data portability – The right to receive personal data concerning yourself provided to the Joint Controllers in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance, in the circumstances contemplated in the GDPR (article 20 of the GDPR),
Right to object – The right to object to processing of personal data concerning yourself, unless the Joint Controllers demonstrate compelling legitimate grounds for the processing (article 21 of the GDPR),
Right to raise a complaint – The right to raise a complaint with the Italian Data Protection Authority: Autorità Garante per la protezione dei dati personali, Piazza Venezia n.11, 00187, Roma (RM).

You may exercise the above rights simply by sending a request by e-mail to the PEC address of the Data Protection Officer provided above.

(i) Method of processing

The processing of personal data is performed through the operations listed in article 4, item 2) of the GDPR – carried out with or without the use of IT systems – in detail: collection, recording, organisation, structuring, updating, storage, adaptation or alteration, retrieval and analysis, consultation, use, disclosure by transmission, comparison, alignment or combination, restriction, erasure or destruction.

In any case, we will guarantee the logic security and physical safety and, in general, the confidentiality of the data by putting in place all necessary technical and organisational measure suitable to ensure their security.

Footnote:

[1] Additional information on the PwC Network and the legal entities belonging to it is available online at www.pwc.com

[2] Regulation EU 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation), in brief, “GDPR”